@wix/himalaya-cli 0.1423.0 → 0.1424.0

package/dist/cli.mjs

@@ -7715,6 +7715,7 @@ function resolveTranslation(value, catalog3, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
+    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s2) => s2 !== "t").join("|")})\\b|^\\$t:`
@@ -10225,15 +10226,44 @@ var init_raw_json_depth = __esm({
 });
 
 // ../../core/dev-server/src/realm-parity.ts
-function withheldGlobalsSource(hide) {
-  if (!hide?.length) return "";
-  return `${JSON.stringify(hide)}.forEach(function (n) { try { delete globalThis[n]; } catch (e) { /* non-configurable: leave it */ } });`;
+function allowlistSweepSource(keep = []) {
+  const key2 = [...keep].sort().join(",");
+  let source = sweepSources.get(key2);
+  if (source === void 0) {
+    source = buildSweepSource([.../* @__PURE__ */ new Set([...WORKER_ALLOWLIST, ...keep])].sort());
+    if (sweepSources.size >= 32) sweepSources.clear();
+    sweepSources.set(key2, source);
+  }
+  return source;
+}
+function buildSweepSource(allow) {
+  return `(function (allow) {
+  var keep = Object.create(null);
+  for (var i = 0; i < allow.length; i++) keep[allow[i]] = true;
+  for (var o = globalThis; o && o !== Object.prototype; o = Object.getPrototypeOf(o)) {
+    var names = Object.getOwnPropertyNames(o);
+    for (var j = 0; j < names.length; j++) {
+      var n = names[j];
+      if (keep[n] || n === "constructor" || n.indexOf("himi.quickjs.") === 0) continue;
+      try { delete o[n]; } catch (e) { /* non-configurable: leave it */ }
+    }
+  }
+})(${JSON.stringify(allow)});`;
+}
+function explainWithheldError(message, deviceParity) {
+  if (!deviceParity || message.includes(FETCH_ADVICE)) return message;
+  return BARE_FETCH_UNDEFINED.test(message) ? `${message} \u2014 ${FETCH_ADVICE}` : message;
 }
 function realmInstallsIntl(intl, hide) {
   return intl === true && !(hide ?? []).includes("Intl");
 }
+var sweepSources, FETCH_ADVICE, BARE_FETCH_UNDEFINED;
 var init_realm_parity = __esm({
   "../../core/dev-server/src/realm-parity.ts"() {
+    init_allowlist();
+    sweepSources = /* @__PURE__ */ new Map();
+    FETCH_ADVICE = "`fetch` is not available to a Tier-5 worker (no device has it: iOS's JSContext never did and the Android worker strips it, #4499) \u2014 load data through the sanctioned Wix transport (`@himalaya/wix-*` or `globalThis.himalaya.wixApi.call`).";
+    BARE_FETCH_UNDEFINED = /(?:^|[^.\w$'])'?fetch'? is not (?:defined|a function)\b/;
   }
 });
 
@@ -10266,6 +10296,7 @@ __export(validate_descriptor_core_exports, {
   RAW_JSON_MAX_DEPTH: () => RAW_JSON_MAX_DEPTH,
   SERVICE_ONLY_BINDING_PROPS: () => SERVICE_ONLY_BINDING_PROPS,
   WHOLE_VALUE_BINDING: () => WHOLE_VALUE_BINDING,
+  allowlistSweepSource: () => allowlistSweepSource,
   bareNestedClass: () => bareNestedClass,
   bootBundleWorker: () => bootBundleWorker,
   collectServiceBindings: () => collectServiceBindings,
@@ -10275,6 +10306,7 @@ __export(validate_descriptor_core_exports, {
   deviceParityWithheldFrom: () => deviceParityWithheldFrom,
   dryRunBundle: () => dryRunBundle,
   enumFieldNames: () => enumFieldNames,
+  explainWithheldError: () => explainWithheldError,
   extractBundleContract: () => extractBundleContract,
   extractBundleServices: () => extractBundleServices,
   findSkipDerive: () => findSkipDerive,
@@ -10301,7 +10333,6 @@ __export(validate_descriptor_core_exports, {
   setDefaultEvaluator: () => setDefaultEvaluator,
   topBarFindings: () => topBarFindings,
   validateScreenDescriptor: () => validateScreenDescriptor,
-  withheldGlobalsSource: () => withheldGlobalsSource,
   workerSubtreeAllowed: () => workerSubtreeAllowed
 });
 function makeInert() {
@@ -10699,6 +10730,7 @@ async function bootBundleWorker(bundleJs, opts) {
         timeoutMs: 2e3 + budgetMs,
         filename: "himi-bundle.js",
         hide,
+        deviceParity: opts.deviceParity === true,
         wixCall: wixApi.call,
         dispatch: dispatchHost,
         skipLoad: opts.skipLoad === true,
@@ -10709,13 +10741,13 @@ async function bootBundleWorker(bundleJs, opts) {
       guestActions = ran.actions;
       guestSession = ran.session;
       if (ran.error) {
-        errors.push({ service: "(boot)", message: ran.error });
+        errors.push({ service: "(boot)", message: explainWithheldError(ran.error, opts.deviceParity === true) });
       }
     } else {
-      realm.run(bundleJs, sandbox, { timeoutMs: 2e3, filename: "himi-bundle.js", hide, ...pins });
+      realm.run(bundleJs, sandbox, { timeoutMs: 2e3, filename: "himi-bundle.js", hide, deviceParity: opts.deviceParity === true, ...pins });
     }
   } catch (err) {
-    errors.push({ service: "(boot)", message: err?.message ?? String(err), ...err?.stack ? { stack: err.stack } : {} });
+    errors.push({ service: "(boot)", message: explainWithheldError(err?.message ?? String(err), opts.deviceParity === true), ...err?.stack ? { stack: err.stack } : {} });
   }
   const clone = (v2) => {
     try {
@@ -10788,6 +10820,17 @@ async function bootBundleWorker(bundleJs, opts) {
     delete state._error;
     return state;
   }
+  const explainActionError = (err) => {
+    if (!(err && typeof err === "object" && typeof err.message === "string")) return;
+    const e2 = err;
+    const explained = explainWithheldError(e2.message, opts.deviceParity === true);
+    if (explained !== e2.message) {
+      try {
+        e2.message = explained;
+      } catch {
+      }
+    }
+  };
   const commitActionFailure = (def, err) => {
     const prev = def.state;
     if (!prev || typeof prev !== "object" || Array.isArray(prev)) return;
@@ -10818,6 +10861,7 @@ async function bootBundleWorker(bundleJs, opts) {
       const next = await Promise.race([Promise.resolve(fn2(def.state, ...args)), timeout]);
       applyResult(def, next);
     } catch (err) {
+      explainActionError(err);
       commitActionFailure(def, err);
       throw err;
     } finally {
@@ -10833,6 +10877,7 @@ async function bootBundleWorker(bundleJs, opts) {
         def.state = entry.state;
       }
       if (entry.error !== void 0) {
+        entry.error = explainWithheldError(entry.error, opts.deviceParity === true);
         commitActionFailure(def, entry.error);
         if (recordErrors && entry.reportError) errors.push({ service: entry.name, message: entry.error });
         continue;
@@ -12658,6 +12703,7 @@ var init_validate_descriptor_core = __esm({
     init_worker_subtree();
     init_raw_json_depth();
     init_realm_parity();
+    init_realm_parity();
     CRAWL_BLOCKING_PASSES = /* @__PURE__ */ new Set([
       // A screen whose bindings do not resolve has no state to crawl.
       "bindings",
@@ -14241,6 +14287,7 @@ __export(validate_descriptor_exports, {
   RAW_JSON_MAX_DEPTH: () => RAW_JSON_MAX_DEPTH,
   SERVICE_ONLY_BINDING_PROPS: () => SERVICE_ONLY_BINDING_PROPS,
   WHOLE_VALUE_BINDING: () => WHOLE_VALUE_BINDING,
+  allowlistSweepSource: () => allowlistSweepSource,
   appWorkerActionsFor: () => appWorkerActionsFor,
   bareNestedClass: () => bareNestedClass,
   bootBundleWorker: () => bootBundleWorker,
@@ -14253,6 +14300,7 @@ __export(validate_descriptor_exports, {
   discoverNativeActions: () => discoverNativeActions,
   dryRunBundle: () => dryRunBundle,
   enumFieldNames: () => enumFieldNames,
+  explainWithheldError: () => explainWithheldError,
   extractBundleContract: () => extractBundleContract,
   extractBundleServices: () => extractBundleServices,
   findSkipDerive: () => findSkipDerive,
@@ -14285,7 +14333,6 @@ __export(validate_descriptor_exports, {
   setDefaultEvaluator: () => setDefaultEvaluator,
   topBarFindings: () => topBarFindings,
   validateScreenDescriptor: () => validateScreenDescriptor,
-  withheldGlobalsSource: () => withheldGlobalsSource,
   workerSubtreeAllowed: () => workerSubtreeAllowed
 });
 import { readFileSync as readFileSync15, existsSync as existsSync13, readdirSync as readdirSync11 } from "node:fs";
@@ -14387,8 +14434,9 @@ var init_validate_descriptor = __esm({
     nodeVmEvaluator = {
       run(code, sandbox, opts) {
         const context = createContext(sandbox);
-        const hideSource = withheldGlobalsSource((opts.hide ?? []).filter((name) => !(name in sandbox)));
-        if (hideSource) runInContext(hideSource, context, { filename: "himi-hide.js" });
+        if (opts.deviceParity) {
+          runInContext(allowlistSweepSource(Object.keys(sandbox)), context, { filename: "himi-sweep.js" });
+        }
         const pins = pinnedIntrinsicsSource(opts);
         if (pins) {
           const pinned = runInContext(`(${pins})(Date, Math)`, context, { timeout: opts.timeoutMs, filename: "himi-pins.js" });
@@ -16127,6 +16175,10 @@ ${opts.liveTransport ? `  // Every action completion crosses as a RAW, ordered r
   // minimum local overlay needed for the worker's own subsequent reads; the host replays these
   // records through applyResult, which remains the authoritative merge/directive dialect.
   var actionBody = "";
+  // The host bridges, captured into this closure: under deviceParity the closing sweep deletes
+  // them from globalThis, so a bundle cannot call a bridge that exists on no device (#4537).
+  var hostWixCall = globalThis.__himiWixCall;
+  var hostDispatch = globalThis.__himiDispatch;
   var isArray = Array.isArray;
   var promiseResolve = Promise.resolve.bind(Promise);
   var promiseReject = Promise.reject.bind(Promise);
@@ -16375,7 +16427,7 @@ ${opts.liveTransport ? `      var handle = { getState: function () { return def
       call: function (method, path, body, headers) {
         var raw;
         try {
-          raw = __himiWixCall(
+          raw = hostWixCall(
             String(method),
             String(path),
             stringify(body === undefined ? null : body),
@@ -16397,7 +16449,7 @@ ${opts.liveTransport ? `      var handle = { getState: function () { return def
     dispatch: function (action, params) {
       var raw;
       try {
-        raw = __himiDispatch(stringValue(action), stringify(params === undefined ? null : params));
+        raw = hostDispatch(stringValue(action), stringify(params === undefined ? null : params));
       } catch (e) {
         return promiseReject(e instanceof Error ? e : new Error(stringValue(e)));
       }
@@ -16526,9 +16578,11 @@ ${opts.clock === void 0 ? "" : opts.freezeDate ? `  globalThis.Date = (${pinnedI
       return sweepPromise;
     },
   });` : ""}
-  // LAST, so nothing the prelude installed (the \`fetch\` stub) or the engine carries natively
-  // (QuickJS-ng 0.15's \`performance\`, \`queueMicrotask\`) survives deviceParity (#4511).
-  ${withheldGlobalsSource(opts.hide)}
+  // LAST, under deviceParity: the realm sweeps its OWN globals against the worker allow-list
+  // (#4537), so nothing the prelude installed (the \`fetch\` stub), nothing the engine carries
+  // natively (QuickJS-ng 0.15's \`performance\`, \`queueMicrotask\`) and none of the host bridges
+  // (\`__himiWixCall\`, \`__himiDispatch\` \u2014 captured into this closure above) survives.
+  ${opts.deviceParity ? allowlistSweepSource() : ""}
   return ${opts.liveTransport ? "{ readback: readback, dispatch: dispatchAction, actions: readActions }" : "readback"};
 })();
 `;
@@ -16597,6 +16651,7 @@ async function createQuickJsEvaluator(options = {}) {
             clock: opts.clock ?? options.clock,
             freezeDate: opts.clock !== void 0,
             hide: opts.hide,
+            deviceParity: opts.deviceParity === true,
             ...opts.seed === void 0 ? {} : { seed: opts.seed },
             ...opts.mirrorRandom ? { mirrorRandom: true } : {}
           }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1423.0",
+  "version": "0.1424.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "843d4fd1bc22694e9fd665efd8f59bb6fd4e4e9aa78612885a3ce661"
+  "falconPackageHash": "a0147b33ea7375fa7cf11b0027a0388feef592ede284346c3d5c9919"
 }